Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2022-24812 |
CWE-ID | CWE-264 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Grafana Web applications / Other software |
Vendor | Grafana Labs |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU62283
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-24812
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to a design error related to caching of API keys and privilege management. When fine-grained access control is enabled and a client uses Grafana API Key to make requests, the permissions for that API Key are cached for 30 seconds for the given organization. Because of the way the cache ID is constructed, the consequent requests with any API Key evaluate to the same permissions as the previous requests.
As a result, if the first request is made with Admin permissions, and the second request with different API Key is
made with Viewer permissions, the second request will get the cached
permissions from the previous Admin request, resulting in privilege escalation.
Install updates from vendor's website.
Vulnerable software versionsGrafana: 8.1.0 - 8.4.5
External linkshttp://github.com/grafana/grafana/security/advisories/GHSA-82gq-xfg3-5j7v
http://grafana.com/docs/grafana/latest/release-notes/release-notes-8-4-6/
http://grafana.com/blog/2022/04/12/grafana-enterprise-8.4.6-released-with-high-severity-security-fix/
http://github.com/grafana/grafana/releases/tag/v8.4.6
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.